Privacy Policy
Mosaic Masterpiece · Version 2.1 · Last updated 14 September 2026
The short version
- There is no account and no login. The game never asks for your name, your email or your address.
- Your game progress is stored on your own device, not on our servers.
- The one exception is the early access form on the website. If you choose to sign up to test the game, you give us your email. We use it only to send you the invite, and we delete it if you ask.
- Analytics and session recording run only if you agree. If you decline, they never start, and the game plays exactly the same.
- The game may show adverts, provided by Google AdMob. In the EU you choose whether those adverts are personalised.
- We do not sell your data. Ever.
Who is responsible for your data
Mosaic Masterpiece is made and operated by Bakr, an
independent developer established in France. For the purposes of the General Data
Protection Regulation (EU 2016/679, "GDPR") and the French Data Protection Act
(Loi n° 78-17 Informatique et Libertés), Bakr is
the data controller.
Contact for any privacy question or request:
the contact address shown on the game's store listing.
We are a one-person operation and are not required to appoint a Data Protection
Officer. Requests go straight to the person who wrote the game.
What we collect
Usage data (analytics)
We use PostHog, on its European Union hosting, to understand how
the game is played. On the web version this runs only after you accept it on
the opening screen. When it is running we record events such as: which screen
you opened, which tutorial step you reached, when you started and finished a puzzle,
how long it took, how many hints you used, which language the game is in, and whether
you are playing on the web or on Android.
Each device is given a random identifier (for example
anon_m4x8k2p9). It is created on your device, it is not linked to your
name or your email, and it exists only so that several sessions from the same device
can be counted as one player rather than many. It is a pseudonym, not anonymity: while
it exists it is still personal data under the GDPR, and it is treated as such.
PostHog also receives technical information that any website receives: your device
type, browser or operating system, and your IP address, from which an approximate
country is derived. We do not use it to identify you.
Session recording (web version)
On the web version, and only if you accept, we record a
replay of the session — the taps, scrolls and screens — so we can see
where the game confuses people. Anything typed into an input field is masked
and is not recorded. Recordings are tied only to the random identifier above.
If you decline, no recording is made and none is uploaded. The analytics library is
not even loaded.
Data stored on your device
Your progress — restored mosaics, coins, the state of your museum, your settings,
your chosen language and your privacy choices — is saved in your device's local
storage. It stays on your device. We cannot read it, and we do not have a copy.
If you clear the app's data, or if your browser deletes it, that progress is
gone and cannot be recovered by us. Browsers — Safari in particular — may
delete site data on their own after a period of inactivity.
Early access sign-up (the website, not the game)
The website invites you to ask for early access to the game while it is still in
testing. That button opens a form hosted by Google Forms. If you choose
to fill it in, we receive your email address, whether your phone is
Android or iPhone, and anything you write in the optional message box. Nothing else.
The game itself never asks for any of this, and you can play without
ever going near the form.
Why we need it: a test invite has to be sent somewhere. On Android,
Google Play admits a tester only if the address is the Google account signed in on their
phone, which is why the form is insistent about that particular address.
Where it lives: in Google Forms and the spreadsheet behind it, inside
our own Google account, from which the addresses are entered into the tester list in
Google Play Console or Apple TestFlight. It is never published, never sold, and never
used for a newsletter or for advertising. For this, Google is our
processor.
Legal basis: your consent, GDPR Art. 6(1)(a). You
typed the address in order to be invited, and you can take it back at any time.
How long we keep it: until the closed test ends, and then it is
deleted. Sooner if you ask. Write to the contact address in the website
footer and the entry is removed, with no need to give a reason.
Cookies and local storage
The game does not use advertising cookies of its own. It stores information on your
device in two categories:
| What | Why | Needs your consent? |
|---|
| Game save, settings, language, your privacy choice | The game cannot work without them | No — strictly necessary |
| PostHog analytics identifier and session recording | Understanding how the game is played | Yes |
| Google AdMob advertising identifiers | Selecting and measuring adverts | Yes, for personalised advertising |
This reflects Article 82 of the French Data Protection Act and the CNIL's guidance
on trackers: only strictly necessary storage is exempt from consent.
Adverts
The game can show adverts supplied by Google AdMob. Advertising is
how a free game pays for itself.
For players in the European Economic Area, the United Kingdom and Switzerland, you
are asked for your choice through Google's consent form before personalised adverts are
served, in line with Google's EU User Consent Policy. You may choose
non-personalised advertising, and you can change that choice at any time in the game's
Settings.
- Personalised adverts use an advertising identifier and previous
activity to choose what to show you.
- Non-personalised adverts are chosen from the context rather than
from your history. They still use a limited identifier for frequency capping and
fraud prevention, which Google treats as necessary for serving an advert at all.
For the data it collects through adverts, Google acts as an independent
controller, under its own policies rather than ours. We do not receive your
advertising identifier and we cannot see who you are.
Purchases
If the game offers in-app purchases, they are handled entirely by
Google Play Billing or, on iOS, by Apple. We never see, receive
or store your payment card details. We receive only confirmation that a
purchase succeeded, so the game can grant what you bought.
Refunds and billing history are handled by the store you bought through, under that
store's own terms.
What we do NOT collect
- No name, phone number or postal address
- No email address from the game. The one place we ask for one is the early
access form on the website, described above, and only if you choose to use it
- No account, no login, no password
- No contacts, photos, files, microphone or camera
- No precise location — country level at most, derived from the IP address
- No text you type: inputs are masked in session recording
- No special category data: nothing about health, beliefs, politics, or biometrics
- No payment details
Why we are allowed to do this (legal bases)
| What | Legal basis (GDPR Art. 6) |
|---|
| Running the game, saving your progress on your device | Contract — Art. 6(1)(b). You asked to play; the game must be able to work. |
| Analytics and session recording | Consent — Art. 6(1)(a). You are asked before anything starts, and you may refuse or withdraw. |
| Personalised advertising | Consent — Art. 6(1)(a), collected through Google's consent form. |
| Non-personalised advertising, fraud prevention, frequency capping | Legitimate interest — Art. 6(1)(f): funding a free game and preventing abuse, balanced against the very limited data used. |
| Keeping a record of your privacy choice | Legal obligation — Art. 6(1)(c). We must be able to show what you chose. |
| Your email address, if you sign up for early access on the website | Consent — Art. 6(1)(a). You gave it so we could invite you, and you may ask for it back. |
Refusing consent costs you nothing. Every feature of the game works
identically whether you accept or decline.
Who else sees the data
| Who | What for | Their role |
|---|
| PostHog | Analytics and session recording, on EU hosting | Processor, acting on our instructions |
| Google AdMob | Serving and measuring adverts | Independent controller |
| Google Play / Apple | Distribution and payments | Independent controllers |
| Vercel | Hosting the web version; standard server logs | Processor |
| Google Forms / Google Sheets | Holding early access sign-ups: the email you gave us so we can send the test invite | Processor, acting on our instructions |
We do not sell data, and we do not share it with anyone not listed
above. We would disclose data only if legally compelled to do so.
Where the data goes
PostHog analytics for this game are on its European Union hosting,
so that data stays in the EU.
Google and Vercel are United States companies and may process data outside the
European Economic Area. Those transfers rely on the safeguards those companies publish
— the European Commission's Standard Contractual Clauses and, where
applicable, the EU–US Data Privacy Framework. Their own policies,
linked in this document, describe the arrangements in force.
How long we keep it
| What | Kept for |
|---|
| Analytics events | Up to 12 months, then deleted |
| Session recordings | Up to 30 days, then deleted |
| Your privacy choice | Until you change it or clear the app's data |
| Your game save | On your device, until you delete it |
| Advertising data held by Google | Under Google's own retention rules |
| An early access sign-up email | Until the closed test ends, then deleted. Sooner if you ask |
Automated decisions and profiling
We do not make any automated decision that produces legal effects for you or
similarly significantly affects you. The game's difficulty adapts to your progress,
which is ordinary game design and not a decision about you as a person.
If you consent to personalised advertising, Google may profile you for advertising
purposes under its own policies. Declining personalised adverts stops that.
Children
This game is not directed at children. We do
not knowingly collect personal data from children. In France, a minor may consent to
online services on their own from the age of 15; below that age,
consent must be given jointly by the minor and the holder of parental responsibility.
If you believe a child has provided data to us, write to
the contact address shown on the game's store listing and we will delete it.
Your rights
Under the GDPR you have the right to:
- Access — ask what data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — ask for your data to be deleted
- Restriction — ask us to stop using it while a question is resolved
- Portability — receive the data you gave us, in a usable format
- Objection — object to processing based on legitimate interest
- Withdraw consent at any time, without affecting what was lawful before
- Digital legacy — under French law, give instructions about your data after your death
Because almost everything we collect is pseudonymous, we usually cannot connect it to
you personally, and the GDPR does not require us to collect extra information just to be
able to. If you want your analytics data deleted, write to us and include the
random identifier shown in the game's Settings screen, and we will delete
everything matching it.
An early access sign-up is the one thing we can look up by name. If
you gave us your email on the website form, write to us from that address, or simply
tell us what it is, and we will show you the entry, correct it, or delete it.
To delete everything held on your device, clear the app's data or uninstall it.
We answer requests within one month, as the GDPR requires.
If you are not satisfied, you may complain to a supervisory authority. In France
that is the CNIL — cnil.fr/en/plaintes,
or 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. You may also complain to the
authority in your own country of residence.
Changing your mind
Open Settings → Privacy in the game. From there you can turn
analytics and session recording on or off, and change your advertising choice. The
change takes effect immediately and lasts until you change it again.
Security
The game is served over HTTPS. Analytics are transmitted encrypted. Because there is
no account and no server-side save, there is no database of players to be stolen — the
most private thing about this game is that we chose not to hold anything. The only list
of email addresses that exists is the early access sign-up sheet, which lives in a Google
account protected by two-step verification and is deleted when the test ends.
Should a data breach ever occur that is likely to result in a risk to your rights, we
will notify the CNIL within 72 hours as the GDPR requires, and inform players where
required.
Changes
If this policy changes we will update the version and date at the top of this page.
If the change is significant, we will say so in the game and, where the law requires it,
ask for your consent again.
Questions about privacy, or a request about your data:
the contact address shown on the game's store listing
Please put "Privacy" in the subject line, and include the random identifier
from Settings if your request is about analytics data.